HL7 Spezifikationen für fortgeschrittene Lösungen für Security, Privacy & Safety

Transkript

1 Mit Sicherheit HL7 Security, Safety und Privacy in e-health HL7 Spezifikationen für fortgeschrittene Lösungen für Security, Privacy & Safety Prof. Dr. habil., FACMI, FACHI, FHL7 Head,, Deggendorf Institute of Technology, Germany Formerly ehealth Competence Center at University of Regensburg Medical Center Past-Chair HL7 Germany

2 Security, Privacy, and Trust - Definitions Security covers concepts, services, mechanisms and data to guarantee integrity, availability, authenticity, accountability and confidentiality of information. Privacy is a human right for self-determination, respecting wishes and demands regarding collection, processing, communication and use of personal information, thereby preventing harm from disclosure. Trust defines the individual expectations in the context of the collection, processing, communication and use of personal information. It allows acceptance of risk and balancing privacy needs against benefits. Trust can be based on knowledge and experiences of an entity about actors and processes involved in (personal) data management regulations transparently established for ruling related actors behavior and processes legislation binding actors and enforcing processes (law enforcement) services technically enforcing the processes and policies.

3 data algorithms mechanisms services concepts HL7 Spezifikationen für fortgeschrittene Lösungen für Security, Privacy & Safety safety security quality communication security application security identification authentication integrity confidentiality authorisation access control confidentiality audit accountability non-repudiation notary s functions availability accountability non-repudiation notary s functions availability access control integrity accuracy digital signature hashing encryption multiple comp. digital signature hashing key recovery key escrowing fire pro-... tection encryption multiple comp. fire pro-... tection DES IDEA RSA DSA DES IDEA... SHA-1 MD5 EL- GAMAL SHA-1 MD5 RSA... DSA EL- GAMAL data keys certificates data keys certificates

4 The Legal Framework: Challenges and Solutions (after O. Tene & J. Polonetsky) The existing privacy framework focuses on the definition of PII, the principles of data minimization and purpose limitation, and the concept of consent. Investigations also argue that, inevitably, these elements of the privacy framework should adjust to reflect existing technological and organizational realities, which include ubiquitous data collection and individuals who are ill-placed to meaningfully review privacy policies. They argue that the Fair Information Practice Principles (FIPPs: Transparency, Individual Control, Respect for Context, Security, Access, Accuracy, Focused Collection, and Accountability) should be used as a set of levers, which can be modulated to address big data by relaxing the principles of data minimization and individual control while tightening requirements for transparency, access, and accuracy.

5 Objectives This presentation introduces into new standards for privilege management and access control communication and cooperation in healthcare. It refers to NIST RBAC, HL7 RBAC Healthcare Permission Catalog, HL7 Healthcare Privacy and Security Classification System (HCS) Release 1 as well as policy-driven RBAC using explicit ontology-based policies according ISO

6 Entity Entity Permission Object Entity Role Role Permission Object

7 Role-Based Access Control (NIST) SR_Policy Role_Hierarchy 1 Structural_Role Target_Policy 1..* FR_Policy 1 Principal 0..* User_Assignment 0..* 0..* 1 1..* Functional_Role 1 Permission_Assignment 0..* 0..* 1..* Target_Component User_Session 1..* 1..* Session Session_Role 1..* 1 Process_Policy

8 HL7 RBAC Healthcare Permission Catalog Healthcare Scenario Roadmap Maps Work Tasks

9 Security Policy (ISO 22600) Security policy is a complex of legal, organizational, functional, social, ethical and technical aspects to be considered in the context of privacy and security. Security policy defines a framework, privileges and obligations, but also consequences and penalties when the regulations are ignored.

10 System s Architecture A system s architecture describes the systems elements (components), their functions and interrelations. The representation of aspect (domains) of a real world system has to be based on the domains ontologies. Rules for selecting components and functions as well as constraints of the relations according to a business case are called policies. Policies define the intended behavior of a systems. Therefore, flexible, scalable, business-controlled, adaptive, knowledge-based, intelligent systems must follow a systemsoriented, architecture-centric, ontology-based and policydriven approach.

11 Business View Information View Computational View Engineering View Technology View Business View Information View Computational View Engineering View Technology View HL7 Spezifikationen für fortgeschrittene Lösungen für Security, Privacy & Safety Domain Perspective System s Architectural Perspective Resource Domain Policy Domain Medical Domain Admin./Org.Policy Domain Contextual Policy Domain Clinical Policy Domain Business Concepts Relations Networks Aggregations Details Development Process Perspective Formerly ehcc at the University of Regensburg Medical a Center b

12 Policy Ontology (ISO 22600)

13 Policy-Driven Role-Based Access Control SR_Policy Role_Hierarchy 1 Structural_Role Target_Policy 1..* FR_Policy 1 Principal 0..* User_Assignment 0..* 0..* 1 1..* Functional_Role 1 Permission_Assignment 0..* 0..* 1..* Target_Component User_Session 1..* 1..* Session Session_Role 1..* 1 Process_Policy

14 Security Labels Security labels are meta-data of personal health information (PHI). They classify constraints on the WHO, HOW, WHEN, WHERE, WHAT FOR and WHY or in other words, on the actor (which is not necessary a person) and the context for accessing and using PHI. Security Labels are tags linking an information object with a set of security and privacy attributes. They can be bound to data, but also to persons and resources. In the new HL7 Healthcare Privacy and Security Classification System (HCS), the following security labels have been defined: Confidentiality, Sensitivity, Integrity, Compartment and Handling Caveats.

15 HL7 Healthcare Privacy and Security Classification & NIST FIPS 188 Security Label HL7 Spezifikationen für fortgeschrittene Lösungen für Security, Privacy & Safety

16 HCS Security Label Field Usage Notes Field 3: Integrity

17 HCS Security Label Field Usage Notes Field 3: Integrity

18 HCS Security Label Field Usage Notes Field 3: Integrity

19 HCS Security Label Field Usage Notes Field 3: Integrity

20 HCS Security Label Field Usage Notes Field 3: Integrity

21 Security Label

22 Security Labels The Security Category Named Tag set characterizes security and privacy rules for certain clinical information, i.e., they are characteristics of the information objects. Handling Caveats Labels enable the identification of communication and distribution controls, purpose of use, refrain policies and obligations to which custodians and recipients of data passed between systems must comply. They are characteristics of the deployment process. The Handling Caveat Security Label field may also convey privacy marks that are to be rendered when the labeled information is accessed.

23 OpenXML Encoded Example of a SPIF for a Confidentiality Label

24 Security Labeling for Privilege Management and Access Control By defining meta-data such as Access Levels entities must comply for accessing protected IT resources; Clearances granted to an actor for accessing data and information at or below a certain security and privacy level (they are applied to information initiators); Security Labels within a health classification system, applied to resources and data exchanged between health information systems; Security Policy Information Files defining which security labels are valid and how they can checked against the Clearances; privilege and access control management in health information systems can be automated. Hereby, Security Label attributes are used in Access Decision Services as Access Control Decision Information Attribute to check clearances allowing the performance of actions on IT resources against access control policies and to enforce those policies without requiring access to the protected information.

25 Access Control Logical Architecture Monitoring Service HL7 Spezifikationen für fortgeschrittene Lösungen für Security, Privacy & Safety Trust Calculation Service Trust Service Trust History DB

26 Data Segmenting EHR Conceptual Components

27

28 Thank you very much for your kind attention! Prof. Dr. rer. nat. habil., FACMI, FACHI, FHL7 Head, Institut of Technology Deggendorf